Potential malware activity detected

[adam900331]

Hy!

I have got a malware notofication regarded to one of the Linux VM. Te report is: Potential malware activity detected. Detection source: Encrypted data.

How can I identify that why Veeam say there are encrypted data? Are there any log?

I cannot use Scan backup on Linux backup...

Thanks.

[david.domask]

Hi adam900331,

Encrypted data alert would come from the Inline Scan feature of Malware detection -- do give the User Guide page a read to better understand how it works, but briefly, the backup data-stream is analyzed and checked for potential signs of encryption. Because it's analyzing the data blocks in flight, there isn't a 1:1 match of "This file looks suspiciously encrypted" as the block in the data-stream doesn't have such a relationship.

Start by checking the Malware Events section in general, but for the encryption alerts it's best to just do a scan on the flagged machine itself or see what processes are running. It is possible this is a false-positive, but it's best to check the machine itself.